Continuous Delivery Foundation cdCon 2021, 24 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Keynote Session: Tamper-proof and Traceability - How to Guarantee a Trustwort... Kevin Lee

Description

Sponsored Keynote Session: Tamper-proof and Traceability - How to Guarantee a Trustworthy DevOps Process - Kevin Lee, Huawei

For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/

A

Hello: everyone, this video is about trustworthiness in devops, I'm hobby cloud, double cloud architect. If a english name is currently I'm primarily responsible for its repository security and the patents today, I will introduce the dev cloud features and give a brief introduction to our experience in just the westness.

A

In the era of digital transformation, rapid and continuous delivery of software has been on top of the agenda for many companies to help these companies with development devops transformation. The cloud has launched a one-stop full process secure and trustworthy devops platform.

A

The entire software left circle from requirement planning development testing deployment to o m is covered in the cloud which has released 13 services.

A

As an underground nd 2 chain, the cloud will be your right hand on every phase of the development in the continuous playing phase. Scrum kanban projects are provided for agile management. Teams of all sizes can choose the one that choose them best in the continuous development phase. You can use it for distributed collaborative development.

A

The cloud enables views using containers and supports popular programming. Languages. Building environment can also be customized.

A

The cloud also provides cloud ide, a cloud-based web development environment. It supports 40 programming languages. Many open source components are available for download at huawei mirrors. In the continuous testing phase. The cloud provides test management, api testing and performance testing. You can perform code free testing on restful and swagger apis in the continuous deployment surface, dev cloud provides cloud deploy, cloud release and cloud pipeline cloud pipeline allows you to create a public to arches, checked, encoder checks, views tests and deployment in a parallel or serial manner. You can run the pipeline in one click.

A

The delivery efficiency is thereby greatly.

A

Improved in huawei, we believe that trustworthiness is the degree of certainty that each system has six characteristics: reliability, available, availability, security, readiness, privacy, safety, reliability and the ability to perform, as required, without failure for a given time interval under given conditions availability, the ability to be in a state to perform when required, security, the ability of the system to remain protected against malicious, deliberate threats, resonance the ability of against attack and recover privacy nobility provide for the rights safety in dealing with the malfunctioning behavior of the system.

A

Essential features of the trustworthiness approach is a confidentiality integrity by the treasability confidentiality is the ability to keep information from being disclosed integrating the product by the complete from development, to delivery, to the customer through the supply chain and has not been maliciously contaminated or counterfeited.

A

Changeability and the degree of certainty that each entity of a product has a reason for being our e2e software life circle also need to guarantee these characteristics.

A

For the second time, let's take integrity as a example as a sample for analysis and discussion.

A

During the developer development process, we may encounter the flooring, risks, open source components and backdoors third-party software logic bombs, external attacker, in fear, changing device resulting in black dots being planted in products at the builder stage, also infiltrate the tools leading to producting planting plantation of at the test stage.

A

Attackers attacking the testing services to satisfy to falsify test results and help the back door go undetected all the hostage and the system face. The stress lots of problems are revealed and real and have occurred at many well-known vendors. How do we mitigate these risks?.

A

During the development phase, we have some advices.

A

First management, the dependencies.

A

During input, risks or worry about vulnerabilities and maintenance capabilities.

A

We can provide dependency vulnerability management trusted, checking selection management, security scanning and other capabilities.

A

Second, in terms of coding programming to meet the clean code principle, we can ensure that the clinical principles are well defined and can be enforced consistently, using ides or other tools.

A

We also can provide a static and dynamic code and analyze analysis tools to determine rule checking committee machine, for example, single function, called submissions, peer reviews, separation of code, entry rights, etc.

A

Code based security exception checking and management, for example, choose changing to strengthen our system. We had a critical event analysis alerting for abnormal behavior analysis.

A

To factor to factor authentication, encrypted storage in schedule.

A

Every change is recall, recorded and traceable to our reason, feasibility, the guarantee and commit integrity protection can be done using such as dvd signatures.

A

Feasibility of code, design and requirements, we do this to make sure every line of code has a purpose and meaning.

A

During the build phase, the success change is processed and defined, and the environment is cured.

A

The environment is a confidential and treatable to exceptions.

A

Binaries and release batteries are compatible each release. Batteries can be regenerated at any time with all components.

A

And all these deliver deliverables are safe saved for analysis.

A

We can provide code build package performance assurance such as include gpg, signature integrity, checking of code building environments are cleaned up and rebuilt building environment, isolation, insurable environment, dedication, network package package, integrity, logging, private component chain change, tracking and a timely notification essential.

A

There is a wide range of test tools. I use cloud test diagram as an example. During the test phase, we have the four following suggestions: automated tests are defined and the test environment is secure. For example, private clusters restores isolation, avoiding interfaith interference from other users. More realistic results.

A

Four world regression tests ready for inclusion execution. We can provide the foreign capabilities.

A

Real-Time feedback of test results, multi-environment pipeline automation, testing cloud based elastic resource, pooling mercury use of tesla handsets requirements, use case de by the trace ability to ensure efficient product acceptance.

A

In terms of validation, we can use web vulnerability detection as security checks, apt attack detection essential to have the system to solve the problem.

A

During the deployments, our device is trusted provision process, secure operational process, trusted operational tools, charted the direct deployment of acceptance, trusted integration and uh customer customization.

A

We get the deployment package with integrity checks for make sure the deployment channel is safe and secure. You can use security protocols, also purchase machines installing installing and deploying requests for blogging for post, modern analysis and our patch release. Deployment need to be fast and efficient, effective.

A

Once deployed to the ops platform, we can support the routing operations, such as application upgrades start and stop monitoring and uh support for highly available container clusters. Micro service micro service governance, service, hosting essential.

A

During the o m phase, our advice is: get the ability to troubleshoot same product equipment ability to troubleshoot vulnerabilities of the same time, type across all products ability to find root, causes and consistently informable measures for this type of vulnerability.

A

Greece for degradation, emergency response plan, increased and rehearsed external disclosure of vulnerabilities, meets specifications, isolation and reversal interaction, detection, trojan.

A

A

uh Well, we have shared some of the characteristics required for our trust was worthy process today and if you are interested, we will continue to communicate offline. Thank you. Goodbye.